December 2003 - cypherpunks-legacy

NOT CRYPTO (Sort of): Fwd: OPPOSITION: AFA seeks to expand CDA
by Deranged Mutant 17 Dec '03

17 Dec '03

Got this in the mail. Pardon me if it turns out to be spam, but it's relevant. Pardons to unnamed folx who prefer only crypto stuff. ------- Forwarded Message Follows ------- telstar(a)wired.com (--Todd Lappin-->) wrote: While I warms my heart to know that the American Family Association thinks the Communications Decency act is a dud, the following message demonstrates that the organization does not intend to let the issue rest. Specifically, they're now seeking to expand the scope of Internet Service Provider (ISP) liability for "indecent" content. That makes about as much sense as asking AT&T to censor your telephone conversations, but regardless... the bottom line is that the American Family Association is *very* determined to impose its social agenda on cyberspace through government legislation. Moreover, at this point it's hardly clear to what extent ISP's are or are not liable for online content under the CURRENT provisions of the Communcations Decency Act. Given this ambiguity, a more stringent clamp-down would only expand the "chilling effect" on free speech. Spread the word! --Todd Lappin--> Section Editor WIRED Magazine ========================================= COMPUTER PORNOGRAPHY LAW NOT WORKING, SAYS AFA WASHINGTON, Feb. 14 /PRNewswire/ -- American Family Association issued the following: "Less than one week after the Communications Decency Act was signed into law by President Clinton, it is obvious that the law, designed to curb computer pornography, is not working and never will work," said Patrick Trueman, director of American Family Association governmental affairs. This fact was made clear by the action this week of CompuServe, a major access provider to the Internet, to restore access to pornographic Internet sites it had recently blocked under pressure from German prosecutors. Access providers to the Internet have a financial incentive to provide access to pornography and they will not block such sites until they are under a legalobligation to do so, Trueman said. The Communications Decency Act included specific provisions protecting access providers from criminal liability and until those provisions are repealed, CDA will be nearly useless, he added. Trueman wrote to leaders of pro-family groups today urging them to unite behind a tough anti-pornography measure like that sponsored by Congressman Henry Hyde. The Hyde measure, which would have made anyone liable who knowingly and intentionally provides pornography to children or obscene pornography to anyone, was defeated in committee by supporters of CDA. "The reality is CDA does not work and it will never work. For its enforcement it relies on a massive number of prosecutions by the Justice Department of individuals who put illegal pornography on the Internet while the major distributors and money makers from the distribution of pornography -- the access providers -- are given a free ride," Trueman said in his letter to pro-family leaders. Trueman urged pro-family leaders to act now to change the law. "There is no point in waiting months or years. CompuServe has made that clear in its recent actions which demonstrate that the law has little, if any, deterrent effect," Trueman said in his letter. CONTACT: Patrick A. Trueman of the American Family Association: 202-544-0061 ### Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

The Future of US Intelligence - CoFR Report
by John Young 17 Dec '03

17 Dec '03

The new CoFR report on the future of US intelligence as covered in recent press reports is digitized. Is there a public-spirited site for making it available by http or ftp or both? It's 103 kb long, in ASCII. Altavista did not show this tealeaf -- to us anyhow. _________________________________________________________ Making Intelligence Smarter The Future of U.S. Intelligence Report of an Independent Task Force Sponsored by the Council on Foreign Relations _________________________________________________________ Contents Executive Summary Introduction Background The Setting The Need for Intelligence Collection Priorities Setting Requirements Improving Analysis Economic Intelligence Clandestine Activities Organization Military Issues Intelligence and Law Enforcement Congressional and Public Oversight Additional Views Appendix Members of the Task Force Acknowledgements Publication information _________________________________________________________

1 0

Re: JavaScript to grab email
by Yanni 17 Dec '03

17 Dec '03

> I visited the page using a fake e-mail address, and have yet to be sent > a confirmation e-mail. When it sends the mail, netscape puts your email address that you put into the message in the From: field. This is what that JavaScript is doing. It is not reading any of your files or doing anything "illegal", it is just taking advantage of the way that Netscape sends email. ;) Obviously, either putting nothing or a bogus email address will cause you to not get a confirmation e-mail. It is one of those "why didn't I think of it" things. ;) Simple yet effective. :) -jon Jon S. Stevens yanni(a)clearink.com ClearInk WebMagus http://www.clearink.com/ finger pgp(a)sparc.clearink.com for pgp pub key My apologies for the loss of bandwidth. :-)

1 0

Re: Chaotic physical systems as random number sources
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:46 PM 2/20/96, E. ALLEN SMITH wrote: > I'm curious if anyone knows of any attempts to use a chaotic physical >system (such as the famous double pendulum) as a source of random numbers. I >did an Alta Vista check on the problem, and all I turned up was a paper (in >postscript, so I couldn't read it) on all mathematical pseudorandom number >generators being logical chaotic systems. (It's at >http://csl.ncsa.uiuc.edu/~herring/publications/rand.ps) > One problem that I can see is that of strange attractors. While the >path through each time would be different, they're still _close_ to each other, >and a practical mechanical system might not be sensitive enough to pick up the >differences. This has come up several times. As I recall, some guys at a Navy research lab (San Diego?) were claiming to have a "chaotic encryption" system. As to using chaotic systems for PRNGs or RNGs, the "turbulent flow over disk drive platters causes speed variations" idea, described recently, is of course an example of nominally using a chaotic/turbulent system to defeat predictability. I have at least a couple of paragraphs on chaos and crypto in my Cyphernomicon. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 17:22 2/20/96, IPG Sales wrote: >If you are able to break the system, and everyone knows what we mean by >break, then we will publicly admit that we are snake oil salesmen, and >all the other things that Perry Metzger and others called us. It is by no means clear to me what "breaking the system" means. One does not have to be able to decipher a single message to prove a system to be insecure. Moreover, cryptanalysis is economics: is it more expensive to get the information by analyzing the crypto than it is to get it by other means? Do we have to show an exploitable flaw? Or we have to do the exploit? That might be expensive. Who would judge the contest? The alogrithm aside, IPG provides the intial OTP. Seems to me that IPG can read the messages. End of story. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

9 13

ANNOUNCE: New Crypto Product!
by Ed Carp 17 Dec '03

17 Dec '03

CompuScam, Inc., an unwholly-owned invention of InventiData, is pleased to announce its latest offering in the growingly lucrative Internet Security market. Called "Secure Users Everywhere", SUE is "guaranteed privacy protection for citizen-units everywhere," according to Ed Carp, Chief Scientist, Chief Executive Officer, and Chief Everything Else for CompuScam. In today's press release, Carp said that "SUE is destined to become the dominant market leader in a field full of inferior products." SUE is designed to work in any environment, and provides "Fort Knox" security for Internet users who wish to transact business over the "net". "Up until now, the Internet has been totally exposed, totally wide open to every 12-year-old wannabe cracker with a cheap PC and a modem," said Carp, "but with SUE, all that has changed overnight. Now SUE users can safely and securely exchange the most sensitive of documents, including credit card and checking account numbers, SSN, employee information, credit reports, gold bars - virtually anything that is of value can now be safely transported across the Internet." No details were immediately available on the technical foundations of SUE, but Carp indicated that this is to provide enhanced security for its customers, adding that "you wouldn't want everyone to see your data, would you? Then why would you want everyone to know about how this software works?" According to CompuScam, SUE is composed of a small software "TSR" that is loaded into memory when a computer is first powered up, and a proprietary hardware device, known as a CUD ("compulsive exteriorization device") that provides "total security" for the software. Carp indicated that the software TSR is "completely ITAR/RNG/SHA/RC4/BBS/RSA/MD5 compliant, and meets all government standards for the very highest levels of cryptographic software, including FIPS-180, SESAME, and STU-III." The hardware device is reportedly PRNG/RNG compliant. Additionally, the SUE product is reportedly backwards-compatible with most other manufacturer's "inferior" cryptographic products, including products from Digital Pathworks, AT&T, VeriSign, IBM, and others. Asked whether or not SUE is compatible with electronic cash offerings from First Virtual and others, Carp said, "Our total solution is so comprehensive, we're fixed problems that even the National Security Agency hasn't thought of yet. We've also totally addressed the major problems that First Virtual brought to light last month in their press release," adding that no other cryptographic software maker had even responded to First Virtual's announcement, "let alone done anything about it. We are acting now to protect our customers and children on the Internet by providing total coverage of the market." Carp denied rumors that the CompuScam was nothing but a mailbox located in a Mailboxes Etc., branch office in Garland. "I believe you will find that a reporter obtained an early press release which contained an typographical error in our suite number," adding that the company is expecting to move soon to new offices near Sun Microsystems in Palo Alto, adding that "the proximity to so many Silicon Valley companies will no doubt enhance the value of our stock^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^Hquality of our software." When asked about the timing of the release, noting that it was only a few days before the company was scheduled to go public, Carp said, "this is an absolutely wonderful opportunity for investors to get in on the ground floor of this new technology" adding something about a new Porsche which the reporters didn't quite catch. SUE is available for PCs running all versions of Microsoft Windows, Windows 95, Windows NT and MS-DOS, as well as all UNIX and UNIX-like platforms, and MVS. The CUD hardware device is available in .357, .45, .44 Magnum, and 9MM versions. Pricing was not immediately available. -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/digital pager 800/558-3408 SkyPager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi "Past the wounds of childhood, past the fallen dreams and the broken families, through the hurt and the loss and the agony only the night ever hears, is a waiting soul. Patient, permanent, abundant, it opens its infinite heart and asks only one thing of you ... 'Remember who it is you really are.'" -- "Losing Your Mind", Karen Alexander and Rick Boyes The mark of a good conspiracy theory is its untestability. -- Andrew Spring

2 1

ANNOUNCE: Crypto++ 2.0
by Wei Dai 17 Dec '03

17 Dec '03

Crypto++ 2.0 has just been released. Please see the attached readme file for a description of Crypto++ and what's new in version 2.0. More details and download instructions can be found on my homepage at http://www.eskimo.com/~weidai. Wei Dai Crypto++: a C++ Class Library of Cryptographic Primitives Version 2.0 2/19/1996 This library includes: MD5, MD5-MAC, SHA, HAVAL, DES, IDEA, WAKE, 3-WAY, TEA, SAFER, Blowfish, Diamond2, Diamond2 Lite, Sapphire, Luby-Rackoff, MDC, various modes (CFB, CBC, OFB, counter), DH, DSA, ElGamal, LUC, Rabin, BlumGoldwasser, elliptic curve cryptosystems, BBS, gzip compression, Shamir's secret sharing scheme, Rabin's information dispersal scheme, and zero-knowledge prover and verifier for graph isomorphism. There are also various miscellanous modules such as base 64 coding and 32-bit CRC. RSA and RC5 are noticeably absent. I am still talking to RSA DSI about adding them back into Crypto++. I hope version 2.1 will include them. Crypto++ has been compiled and tested with Borland C++ 4.5, MSVC 4.0, and G++ 2.7.2 on MS-DOS, Windows NT, and a variety of Unix machines. You are welcome to use it for any purpose without paying me, but see license.txt for the fine print. Some short instructions to compile this library: (you probably need to modify this to suit your environment) -- if want to use this library with RSAREF, then 1. get a copy of RSAREF 2. untar or unzip it into a directory below this one 3. type "gcc -c -I. *.c" (in the rsaref/source directory) to compile RSAREF 4. edit config.h (make sure to #define USE_RSAREF) 5. type "g++ -c -Irsaref/source -I. *.cpp" to compile this library 6. type "g++ *.o rsaref/source/*.o -lstdc++ -lm" to link the test driver 7. type "a.out" to run the test driver -- if you DON'T want to use this library with RSAREF, then 1. edit config.h 2. type "g++ -c *.cpp" to compile this library 3. type "g++ *.o -lstdc++ -lm" to link the test driver 4. type "a.out" to run the test driver Finally, a note on object ownership: If a constructor for A takes a pointer to an object B (except primitive types such as int and char), then A owns B and will delete B at A's destruction. If a constructor for A takes a reference to an object B, then the caller retains ownership of B and should not destroy it until A no longer needs it. Good luck, and feel free to e-mail me at weidai(a)eskimo.com if you have any problems. Also, check http://www.eskimo.com/~weidai/cryptlib.html for updates and new versions. Wei Dai History 1.0 - First public release. Withdrawn at the request of RSA DSI. - Has a big bug in the RSA key generation code. 1.1 - Removed RSA, RC4, RC5 - Disabled calls to RSAREF's non-public functions - Minor bugs fixed 2.0 - a completely new, faster multiprecision integer class - added MD5-MAC, HAVAL, 3-WAY, TEA, SAFER, LUC, Rabin, BlumGoldwasser, Elliptic Curve algorithms - added the Lucas strong probable primality test - ElGamal encryption and signature schemes modified to avoid weaknesses - Diamond changed to Diamond2 because of key schedule weakness - fixed bug in WAKE key setup - SHS class renamed to SHA - lots of miscellaneous optimizations

1 0

PGP integrated into Z-Mail
by daw＠orodruin.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

NCD/Z-Mail announces that they've integrated PGP support into their popular email client. This is good news, folks. A chicken in every pot, and PGP on every desktop! ObDisclaimer: I've not tried their PGP interface; I'm not associated with Z-Mail; I know no history; I always misquote everyone. -- Press Contacts: Mike Harrigan Richard Burger/Shari Dupart NCD Software Corporation Miller/Shandwick Technologies (415) 919-2886 415/962-9550 mikeh(a)ncd.com rburger(a)millerwest.com sdupart(a)millerwest.com FOR IMMEDIATE RELEASE NCD Software Unveils New Integrated Security Solution for Z-Mail for Windows, Optimizing Internet Mail Protection New ViaCrypt PGP Solution, Customized for Z-Mail, Brings Users Special Encryption, Decryption and Digital Signature Capabilities E-MAIL WORLD, San Jose, Calif., February 20, 1996 - NCD Software Corporation today unveiled a new optional security feature for its Z-Mail for Windows electronic messaging client, offering users the best integrated point-to-point security now available for Internet e-mail. ViaCrypt, a division of Lemcom Systems, Inc., worked with NCD Software to develop and customize the integration of Z-Mail for Windows and ViaCrypt(TM) PGP(TM) software. With just a few clicks of the mouse, Z-Mail customers using ViaCrypt PGP can now encrypt the e-mail message bodies and arbitrary data file attachments they send, as well as apply digital signatures. Receivers can use ViaCrypt PGP to decrypt the messages and files and to verify the signatures. NCD Software unveiled the new person-to-person security feature today at E-Mail World, Booth 434, in San Jose, CA. Z-Mail is NCD Software's award-winning cross-platform e-mail software. Based on Internet-standard protocols that include POP, SMTP and MIME, Z-Mail has been acclaimed for its ease of use and highly integrated features, including a powerful scripting language, Z-Script, for enhanced customization capabilities. ViaCrypt PGP allows Z-Mail users to create, send and read secure messages by simple menu selection. The integration of ViaCrypt PGP into Z-Mail was achieved through Z-Mail's exclusive scripting capabilities and a front-end built specifically for by ViaCrypt. Message bodies as well as arbitrary file attachments are secured through public-key cryptography: only the person with the corresponding private key can unlock the encrypted file. Digital signatures, another valuable security application provided by ViaCrypt PGP, allow users to verify that the message they received was sent by a specific person and that the message was not altered. "Security has become our customers' primary consideration when it comes to Internet mail," said Mike Harrigan, vice president of marketing at NCD Software. "The integrated solution of Z-Mail and ViaCrypt PGP reflects our commitment to provide our corporate customers with an easy, secure e-mail system." Dave Barnhart, product manager at ViaCrypt, commented, "Combined with the new ViaCrypt PGP encryption and decryption features, Z-Mail now gives users a simple point-and click solution for assuring security when conducting critical business transactions via the Internet." Z-Mail for Windows is available from NCD Software, and is priced at $165 for single users and $95 per user for 200-user licenses. ViaCrypt PGP, which includes the front end that integrates it with Z-Mail for Windows, is priced at $169.00 for single users and $50 per user for 200 to 499 user licenses. It is available now from ViaCrypt and will be available from NCD in March. A full review of Z-Mail for Windows and other Z-Mail products is available over NCD Software's site on the World Wide Web at http://www.ncd.com/Z-Code/zcode.html, or via e-mail at info(a)z-code.com. ViaCrypt information is available over the Web at http://www.viacrypt.com. NCD Software Corporation is a wholly owned subsidiary of Network Computing Devices, Inc. (NASDAQ: NCDI). The company provides desktop information access solutions for network computing environments. NCD Software Corporations is a major supplier of network software products, including PC-Xware software integrating Microsoft Windows and DOS-based PCs into X/UNIX networks, Marathon, a TCP/IP network foundation, and Z-Mail, a cross-platform electronic-mail and messaging system for open systems environments.

1 0

New remailer (vegas) now operational.
by Alan B. Clegg 17 Dec '03

17 Dec '03

Greetings, all. remailer(a)vegas.gateway.com is now on-line. It is a type 1 cpunk remailer running standard ghio code. The following is vegas's PGP key: --SNIP-- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzD9XEQAAAEEALrf7ZZV9ECB6jT0C7uVXByVa5332+yl1QIbx72FI+xWoyWF 5+MQkm803NaLyBabTrDyqJ6xkMLDu8acbH8OaATrAfUBM2qTZIVzlsgpynLkvCRv OOJfV6fHkaNzbHnYKF3JuLPiyPpXTgJDESIEyqEh9bm34YT711XZZ6mRHzrtAAUR tCtWZWdhcyBSZW1haWxlciA8cmVtYWlsZXJAdmVnYXMuZ2F0ZXdheS5jb20+iQB1 AwUQMP1xfZBA6uEVwDr9AQGibwL/adSqV5/12G+cH5cd5VDupuN570qS7dZdr6BI W9msl+TV7Y9KQUVcKqJ2AAZ6Ng0164WD4JgmYqeDqni0oYyk+Rm9IBmddJ/b0g9Z 7XbWH9w7/J8Zbbdx3mi4IpmwPAZe =9SYZ -----END PGP PUBLIC KEY BLOCK----- --SNIP-- which can be verified against ftp://ftp.gateway.com/pgpkeys/remailer.pgp Enjoy, & watch for the anouncement of a new nym server soon..... -abc \ Alan B. Clegg Just because I can \ Internet Staff does not mean I will. \ gateway.com, inc. \ <http://www.gateway.com/>

1 0

Re: Chaotic physical systems as random number sources (fwd)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 4:24 PM 2/20/96 -0600, Jim Choate wrote: >I have used magnetic pendulums for this as well as chaotic dripping (both >with an old C64). On problem I can think of with pendulums would be a low bit rate. What kind or rate do you get from your setup. (Of course with nano-technology pendulums ...) ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0